CVE-2024-6633

Insecure Default in FileCatalyst Workflow 5.1.6 Build 139 (and earlier)

State: Published
Severity: 9.8 Critical
Published: Aug 27, 2024
Updated: Aug 29, 2025
Reserved: Jul 9, 2024

Description

The default credentials for the setup HSQL database (HSQLDB) for FileCatalyst Workflow are published in a vendor knowledgebase article. Misuse of these credentials could lead to a compromise of confidentiality, integrity, or availability of the software.

The HSQLDB is only included to facilitate installation, has been deprecated, and is not intended for production use per vendor guides. However, users who have not configured FileCatalyst Workflow to use an alternative database per recommendations are vulnerable to attack from any source that can reach the HSQLDB.

Scores

CVSS	Score	Vector	Source
3.1	9.8 Critical	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H	Fortra

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
CWE-798 Use of Hard-coded Credentials

Affected Products

Product	Versions
FileCatalyst WorkflowFortra	5.0.4 through 5.1.6 Build 139Affected

References

https://www.fortra.com/security/advisories/product-security/fi-2024-011

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.